PT-2012-2571 · Mozilla+1 · Firefox+2

Magicant Starmen · Publicado 2012-01-31 · Atualizado 2017-09-19 · CVE-2012-0450

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions 4.x through 9.0 SeaMonkey versions prior to 2.7

Description The issue allows local users to potentially read a Firefox Sync key via standard filesystem operations due to weak permissions set for Firefox Recovery Key.html on Linux and Mac OS X systems.

Recommendations For Mozilla Firefox versions 4.x through 9.0, update to a version outside of this range to resolve the issue. For SeaMonkey versions prior to 2.7, update to version 2.7 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-0450

Produtos afetados

Firefox

Seamonkey

Suse

Referências · 10

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14670 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00011.html · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2012:013 · Aviso do Fabricante
• https://bugzilla.mozilla.org/show_bug.cgi?id=716868 · Nota
• http://osvdb.org/78741 · Nota
• http://mozilla.org/security/announce/2012/mfsa2012-09.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72869 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-0450 · Nota de Segurança
• https://mozilla.org/en-US/security/advisories/mfsa2012-09 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0450 · Nota de Segurança